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AMENDMENT TO THE CLAIMS 
This listing of claims will replace all prior versions, and listings, of claims. 

1 . (CURRENTLY AMENDED) A system of intcrccptin g for intercepting multimedia documents 
disseminated from a first network, the system being characterized in that it comprises a module for 
intercepting and processing packets of information each including an identification header and a data 
body, the packet interception and processing module comprising first means for intercepting packets 
disseminated from the first network, means for analyzing the headers of packets in order to determine 
whether a packet under analysis forms part of a connection that has already been set up, means for 
processing packets recognized as forming part of a connection that has already been set up to determine 
the identifier of each received packet and to access a storage container where the data present in each 
received packet is saved, and means for creating an automaton for processing the received packet 
belonging to a new connection if the packet header analyzer means show that a packet under analysis 
constitutes a request for a new connection, the means for creating an automaton comprise in particular 
means for creating a new storage container for containing the resources needed for storing and 
managing the data produced by the means for processing packets associated with the new connection, a 
triplet comprising identifier, connection state flag, storage container> being created and being 
associated with each connection by said means for creating an automaton, and in that it further 
comprises means for analyzing the content of data stored in the containers, for recognizing the protocol 
used from a set of standard protocols such as in particular http, SMTP, FTP, POP, IMAP, TELNET, 
P2P, for analyzing the content transported by the protocol, and for reconstituting the intercepted 
documents. 

2. (CURRENTLY AMENDED) An interc e ption system The system for intercepting multimedia 
documents according to claim 1, characterized in that the analyzer means and the processor means 
comprise a first table for setting up a connection and containing for each connection being set up an 
identifier "connectionld" and a flag "connectionState", and a second table for identifying containers 
and containing, for each connection that has already been set up, an identifier "connectionld" and a 
reference "containerRef" identifying the container dedicated to storing the data extracted from the 
frames of the connection having the identifier "connectionld". 
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3. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 2, characterized in that the flag "connectionState" of the first table for 
setting up connections can take three possible values depending on whether the detected packet 
corresponds to a connection request made by a client, to a response made by a server, or to a 
confirmation made by the client. 

4. (CURRENTLY AMENDED) An interc e ption system The system for intercepting multimedia 
documents according to claim 1, characterized in that the first packet interception means, the packet 
header analyzer means, the automaton creator means, the packet processor means, and the means for 
analyzing the content of data stored in the containers operate in an independent and asynchronous 
manner. 

5. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 1, characterized in that it further comprises a first module for storing the 
content of documents intercepted by the module for intercepting and processing packets, and a second 
module for storing information relating to at least the sender and the destination of intercepted 
documents. 

6. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 5, characterized in that it further comprises a module for storing 
information relating to the components that result from detecting the content of intercepted documents. 

7. (CURRENTLY AMENDED) An interception system according to claim 1, A system for 
intercepting multimedia documents disseminated from a first network, the system being characterized 
in that it comprises a module for intercepting and processing packets of information each including an 
identification header and a data body, the packet interception and processing module comprising first 
means for intercepting packets disseminated from the first network, means for analyzing the headers of 
packets in order to determine whether a packet under analysis forms part of a connection that has 
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already been set up, means for processing packets recognized as forming part of a connection that has 
already been set up to determine the identifier of each received packet and to access a storage container 
where the data present in each received packet is saved, and means for creating an automaton for 
processing the received packet belonging to a new connection if the packet header analyzer means 
show that a packet under analysis constitutes a request for a new connection, the means for creating an 
automaton comprise in particular means for creating a new storage container for containing the 
resources needed for storing and managing the data produced by the means for processing packets 
associated with the new connection, a triplet comprising identifier, connection state flag, storage 
container> being created and being associated with each connection by said means for creating an 
automaton, and in that it further comprises means for analyzing the content of data stored in the 
containers, for recognizing the protocol used from a set of standard protocols such as in particular http, 
SMTP, FTP, POP, MAP, TELNET, P2P, for analyzing the content transported by the protocol, and 
for reconstituting the intercepted documents, the system being characterized in that it further comprises 
a centralized system comprising means for producing fingerprints of sensitive documents under 
surveillance, means for producing fingerprints of intercepted documents, means for storing fingerprints 
produced from sensitive documents under surveillance, means for storing fingerprints produced from 
intercepted documents, means for comparing fingerprints coming from the means for storing 
fingerprints produced from intercepted documents with fingerprints coming from the means for storing 
fingerprints produced from sensitive documents under surveillance, and means for processing alerts, 
containing the references of intercepted documents that correspond to sensitive documents. 

8. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 7, characterized in that it includes selector means responding to the 
means for processing alerts to block intercepted documents or to forward them towards a second 
network, depending on the results delivered by the means for processing alerts. 

9. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 7, characterized in that the centralized system further comprises means 
for associating rights with each sensitive document under surveillance rights, and means for storing 
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information relating to said rights, which rights define the conditions under which the document can be 
used. 

10. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 1, characterized in that it is interposed between a first network of the 
LAN type and a second network of the LAN type. 

11. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 1, characterized in that it is interposed between a first network of the 
Internet type and a second network of the Internet type. 

12. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 1, characterized in that it is interposed between a first network of the 
LAN type and a second network of the Internet type. 

13. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 1, characterized in that it is interposed between a first network of the 
Internet type and a second network of the LAN type. 

14. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 13, characterized in that it further comprises a generator for generating 
requests from sensitive documents to be protected, in order to inject requests into the first network. 

15. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 14, characterized in that the request generator comprises: 

* means means for producing requests from sensitive documents under surveillance; 

* means means for storing the requests produced; 

* means means for mining the first network with the help of at least one search engine using the 
previously stored requests; 
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* means means for storing the references of suspect files coming from the first network; and 

* means means for sweeping up suspect files referenced in the means for storing references and 
for sweeping up files from the neighborhood, if any, of the suspect files. 

16. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 7, characterized in that said means for comparing fingerprints deliver a 
list of retained suspect documents having a degree of pertinence relative to sensitive documents, and 
the alert processor means deliver the references of an intercepted document when the degree of 
pertinence of said document is greater than a predetermined threshold. 

17. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 7, characterized in that it further comprises, between said means for 
comparing fingerprints and said means for processing alerts, a module for calculating the similarity 
between documents, which module comprises: 

a) means for producing an interference wave representing the result of pairing between a 
concept vector taken in a given order defining the fingerprint of a sensitive document and a concept 
vector taken in a given order defining the fingerprint of a suspect intercepted document; and 

b) means for producing an interference vector from said interference wave enabling a 
resemblance score to be determined between the sensitive document and the suspect intercepted 
document under consideration, the means for processing alerts delivering the references of a suspect 
intercepted document when the value of the resemblance score for said document is greater than a 
predetermined threshold. 

18. (CURRENTLY AMENDED) An interception system The system for intercepting multimedia 
documents according to claim 7, characterized in that it further comprises, between said means for 
comparing fingerprints and said means for processing alerts, a module for calculating similarity 
between documents, which module comprises means for producing a correlation vector representative 
of the degree of correlation between a concept vector taken in a given order defining the fingerprint of 
a sensitive document and a concept vector taken in a given order defining the fingerprint of a suspect 
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intercepted document, the correlation vector enabling a resemblance score to be determined between 
the sensitive document and the suspect intercepted document under consideration, the means for 
processing alerts delivering the references of a suspect intercepted document when the value of the 
resemblance score for said document is greater than a predetermined threshold. 

19. (NEW) A system for intercepting multimedia documents disseminated from a first network, the 
system being characterized in that it comprises a module for intercepting and processing packets of 
information each including an identification header and a data body, the packet interception and 
processing module comprising first means for intercepting packets disseminated from the first network, 
means for analyzing the headers of packets in order to determine whether a packet under analysis 
forms part of a connection that has already been set up, means for processing packets recognized as 
forming part of a connection that has already been set up to determine the identifier of each received 
packet and to access a storage container where the data present in each received packet is saved, and 
means for creating an automaton for processing the received packet belonging to a new connection if 
the packet header analyzer means show that a packet under analysis constitutes a request for a new 
connection, the means for creating an automaton comprise in particular means for creating a new 
storage container for containing the resources needed for storing and managing the data produced by 
the means for processing packets associated with the new connection, a triplet comprising <identifier, 
connection state flag, storage container> being created and being associated with each connection by 
said means for creating an automaton, and in that it further comprises means for analyzing the content 
of data stored in the containers, for recognizing the protocol used from a set of standard protocols such 
as in particular http, SMTP, FTP, POP, EVIAP, TELNET, P2P, for analyzing the content transported by 
the protocol, and for reconstituting the intercepted documents, the system being characterized in that 
the first packet interception means, the packet header analyzer means, the automaton creator means, the 
packet processor means, and the means for analyzing the content of data stored in the containers 
operate in an independent and asynchronous manner, and in that it further comprises a first module for 
storing the content of documents intercepted by the module for intercepting and processing packets, 
and a second module for storing information relating to at least the sender and the destination of 
intercepted documents. 



